Skip to content

Windows/DOS executable file (.sys)

.sys file signature | application/octet-stream

The Windows/DOS executable file format is a legacy binary application format originally developed for MS-DOS and maintained through later Microsoft Windows compatibility layers. It is used to launch programs, load system utilities, and package installers or self-extracting archives on older PC systems. Because it is an older executable type, files in this format can contain active code and should be treated cautiously when received from untrusted sources.

High

Magic Bytes

Offset 0
4D 5A

Sources: Wikipedia, Gary Kessler

All Known Signatures

4 signature variants are documented for .sys files across multiple sources.

Hex Signature Offset Sources
4D 5A 0 Wikipedia, Gary Kessler
AA AA AA AA 0 Wikipedia
FF 4B 45 59 42 20 20 20 0 Gary Kessler
FF FF FF FF 0 Gary Kessler

Extension

.sys

MIME Type

application/octet-stream

Byte Offset

0

Risk Level

High

Validation Code

How to validate .sys files in Python

Python 
def is_sys(file_path: str) -> bool:
    """Check if file is a valid SYS by magic bytes."""
    signature = bytes([0x4D, 0x5A])
    with open(file_path, "rb") as f:
        return f.read(2) == signature

How to validate .sys files in Node.js

Node.js 
function isSYS(buffer: Buffer): boolean {
  const signature = Buffer.from([0x4D, 0x5A]);
  return buffer.subarray(0, 2).equals(signature);
}

How to validate .sys files in Go

Go 
func IsSYS(data []byte) bool {
    signature := []byte{0x4D, 0x5A}
    if len(data) < 2 {
        return false
    }
    return bytes.Equal(data[:2], signature)
}

API Endpoint

GET /api/v1/sys
curl https://filesignature.org/api/v1/sys

See the full API documentation for all endpoints and parameters.

Related Formats

.com .dll .exe .cpl .ocx .scr

Frequently Asked Questions

What is a .sys file?

A .sys file is a Windows/DOS executable file file. The Windows/DOS executable file format is a legacy binary application format originally developed for MS-DOS and maintained through later Microsoft Windows compatibility layers. It is used to launch programs, load system utilities, and package installers or self-extracting archives on older PC systems. Because it is an older executable type, files in this format can contain active code and should be treated cautiously when received from untrusted sources.

What are the magic bytes for .sys files?

The magic bytes for Windows/DOS executable file files are 4D 5A at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .sys file?

To validate a .sys file, read the first bytes of the file and compare them against the known magic bytes (4D 5A) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .sys files?

There is no officially registered MIME type for .sys files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .sys files?

Windows/DOS executable file (.sys) files are high risk because they can contain executable code. Never open .sys files from untrusted sources. Always scan with antivirus software, verify the source, and consider running in a sandboxed environment.